agent-availability-report

Pass

Audited by Gen Agent Trust Hub on Aug 17, 2026

Risk Level: SAFECOMMAND_EXECUTIONEXTERNAL_DOWNLOADSPROMPT_INJECTION
Full Analysis
  • [COMMAND_EXECUTION]: The generate-availability-report.js script executes shell commands via execFile. It runs npm view to check package versions and npm install to verify package availability in a temporary directory. It also executes a dynamically generated Node.js script to confirm package resolution.
  • [EXTERNAL_DOWNLOADS]: The skill makes network requests to nvidia.github.io using the fetch API to verify documentation status. It also downloads packages from the public npm registry during the installation check phase. All external resources are associated with the vendor or well-known services.
  • [DYNAMIC_EXECUTION]: The script creates a temporary file resolve-check.mjs at runtime to perform package resolution tests. The content of this script is generated from a hardcoded list of packages and does not incorporate unvalidated external input.
  • [INDIRECT_PROMPT_INJECTION]: The skill processes data from external sources which could potentially contain malicious instructions.
  • Ingestion points: The script fetches content from documentation URLs (e.g., https://nvidia.github.io/elements/) and reads output from npm view commands.
  • Boundary markers: The script does not apply specific boundary markers or "ignore instructions" prompts when formatting the report for the agent.
  • Capability inventory: The skill has the ability to execute shell commands (npm, node) and perform network requests (fetch).
  • Sanitization: The script performs basic sanitization by compacting whitespace and truncating long output, and it validates that docs site content contains specific keywords ("nvidia", "elements").
Audit Metadata
Risk Level
SAFE
Analyzed
Aug 17, 2026, 05:54 AM
Security Audit — agent-trust-hub — agent-availability-report